Journal of Reliable and Secure Computing Home About Editors Current Issue
Beyond Guardrails: Runtime Enforcement for Secure AI Agents-A Systematic Review of Action Control, Isolation, and Policy Enforcement
Review Article  ·  Published: 17 October 2026
Issue cover
Journal of Reliable and Secure Computing
Volume 2, Issue 4, 2026: 236-262
Review Article Open Access

Beyond Guardrails: Runtime Enforcement for Secure AI Agents-A Systematic Review of Action Control, Isolation, and Policy Enforcement

by
Jimmy Ming-Tai Wu Jimmy Ming-Tai Wu 1 ORCID
Lingping Kong Lingping Kong 2 ORCID
Matin Pirouz Matin Pirouz 3 ORCID
Mu-En Wu Mu-En Wu 4 * ORCID
1 Department of Information Management, National Kaohsiung University of Science and Technology, Kaohsiung 80778, Taiwan
2 Department of Computer Science, VSB-Technical University of Ostrava, Ostrava 708 00, Czech Republic
3 College of Science and Mathematics, California State University, Fresno, CA 93740, United States
4 Department of Information and Finance Management, National Taipei University of Technology, Taipei 10608, Taiwan
* Corresponding Author: Mu-En Wu, [email protected]
Volume 2, Issue 4
Volume 2, Issue 4 2026
Received: 16 August 2026 Revised: 16 September 2026 Accepted: 05 October 2026 Published: 17 October 2026 CrossMark
Download PDF 5.53 MB Cite Metrics
DOI: 10.62762/JRSC.2026.526903
ARK: ark:/57805/jrsc.2026.526903
You have full access to this open access article · CC BY 4.0 License

Article Information

Published in Journal of Reliable and Secure Computing
Volume/Issue Volume 2, Issue 4, 2026
Pages 236-262

Abstract

Large language model (LLM) agents turn model-generated decisions into tool calls, API requests, code execution, data access, and transactions. When agent reasoning is manipulated or simply wrong, model-centric guardrails cannot by themselves stop the resulting action. We systematically reviewed runtime-enforcement mechanisms for autonomous and tool-using AI agents in literature published or publicly available from January 2023 to September 2026. Searches of Compendex and the Web of Science Core Collection, followed by deduplication, multi-stage screening, source-grounded eligibility assessment, and targeted snowballing, yielded 58 primary studies, which we coded by enforcement placement, security mechanism, and assurance type. Most studies enforce security at the tool/action boundary (33/58, 56.9%) or inside the agent runtime or harness (18/58, 31.0%), whereas only 7/58 (12.1%) work primarily at the OS/process/execution boundary. Authorization and privilege control (41/58, 70.7%) and action validation (34/58, 58.6%) are the most common mechanism families. Across very different mechanisms and assurance models, a common design emerges: the model proposes an action, and a separate enforcement point decides whether that action may take external effect. Durable authorization, multi-agent delegation, cross-layer enforcement, recovery from partially committed effects, and standardized evaluation remain open problems. These findings suggest that secure agent architectures should separate reasoning from execution authority and place consequential actions behind independently enforceable runtime boundaries.

Graphical Abstract

Beyond Guardrails: Runtime Enforcement for Secure AI Agents-A Systematic Review of Action Control, Isolation, and Policy Enforcement

Keywords

AI agents runtime enforcement agent security execution-time authorization access control runtime verification

Data Availability Statement

Not applicable.

Funding

This work was supported without any funding.

Conflicts of Interest

The authors declare no conflicts of interest.

AI Use Statement

The authors declare that ChatGPT-5 was used for language editing of the manuscript. The authors have carefully reviewed, revised, and verified the AI-assisted output and take full responsibility for the content of the manuscript.

Ethical Approval and Consent to Participate

Not applicable.

References


  1. [Google Scholar]

  2. [Google Scholar]
  3. Ling, Y., Yu, S., Chen, Z., & Fang, C. (2026). Toward Secure LLM Agents: Threat Surfaces, Attacks, Defenses, and Evaluation. arXiv preprint arXiv:2606.10749.
    [CrossRef] [Google Scholar]
  4. Hu, M., Wang, T., Qu, Y., Geng, Y., & Wang, H. (2026). A Focused Survey of Code Agent Security: Attacks, Defenses, and Evaluation. Information and Software Technology, 199, 108288.
    [CrossRef] [Google Scholar]
  5. Xu, Y., Zhuang, Y., Liu, X., Zhang, T., Xiao, B., Xu, X., ... & Hu, H. (2026). LLM Agents Security Duality: A Comprehensive Survey of Self-Security and Empowered Cybersecurity. Artificial Intelligence Review, 59(8), 174.
    [CrossRef] [Google Scholar]
  6. Uchibeke, U. (2026). Before the Tool Call: Deterministic Pre-Action Authorization for Autonomous AI Agents. arXiv preprint arXiv:2603.20953.
    [CrossRef] [Google Scholar]
  7. Wang, H., Poskitt, C. M., & Sun, J. (2026, April). Agentspec: Customizable runtime enforcement for safe and reliable llm agents. In Proceedings of the 2026 IEEE/ACM 48th International Conference on Software Engineering (pp. 2938-2950).
    [CrossRef] [Google Scholar]
  8. Ji, Z., Wu, D., Jiang, W., Ma, P., Li, Z., Gao, Y., ... & Li, Y. (2026). Taming various privilege escalation in LLM-based agent systems: A mandatory access control framework. arXiv preprint arXiv:2601.11893.
    [CrossRef] [Google Scholar]
  9. Garby, Z., Gordon, A. D., & Sands, D. (2026). The llmbda calculus: Ai agents, conversations, and information flow. arXiv preprint arXiv:2602.20064.
    [CrossRef] [Google Scholar]
  10. Wang, P., Zhang, Y., Zhang, R., Guo, J., & Cheng, X. (2026). Token-Flow Firewall: Semantic Runtime Auditing for Persistent AI Agents. arXiv preprint arXiv:2607.08395.
    [CrossRef] [Google Scholar]
  11. Zheng, Z., Li, Y., Qian, C., Fu, Y., Fu, Y., Sheng, L., ... & Liu, D. (2026). Stepguard: Learning step-level guardrails with scalable supervision and safety-utility balancing. arXiv preprint arXiv:2608.24777.
    [CrossRef] [Google Scholar]
  12. Könighofer, B., Bloem, R., Ehlers, R., & Pek, C. (2022). Correct-by-construction runtime enforcement in AI–a survey. In Principles of Systems Design: Essays Dedicated to Thomas A. Henzinger on the Occasion of His 60th Birthday (pp. 650-663). Cham: Springer Nature Switzerland.
    [CrossRef] [Google Scholar]
  13. Wang, H., Poskitt, C. M., Wei, J., & Sun, J. (2026, October). Probguard: Proactive runtime monitoring for llm agent safety via probabilistic prediction. In Proceedings of the 41st IEEE/ACM International Conference on Automated Software Engineering (pp. 1470-1482).
    [CrossRef] [Google Scholar]
  14. Kitchenham, B., & Charters, S. (2007). Guidelines for Performing Systematic Literature Reviews in Software Engineering. Technical Report EBSE-2007-01, Keele University and Durham University. https://legacyfileshare.elsevier.com/promis_misc/525444systematicreviewsguide.pdf
    [Google Scholar]
  15. Wohlin, C. (2014). Guidelines for snowballing in systematic literature studies and a replication in software engineering. In Proceedings of the 18th International Conference on Evaluation and Assessment in Software Engineering (EASE) (pp. 38:1-38:10).
    [CrossRef] [Google Scholar]
  16. Page, M. J., McKenzie, J. E., Bossuyt, P. M., Boutron, I., Hoffmann, T. C., Mulrow, C. D., ... & others (2021). The PRISMA 2020 statement: an updated guideline for reporting systematic reviews. BMJ, 372, n71.
    [CrossRef] [Google Scholar]
  17. Zhao, W., Li, Z., Zhang, P., & Sun, J. (2026). ClawGuard: A runtime security framework for tool-augmented LLM agents against indirect prompt injection. arXiv preprint arXiv:2604.11790.
    [CrossRef] [Google Scholar]
  18. Xu, J., Fan, L., Wang, Z., Li, X., & Liu, H. (2026). Beyond single-use tokens: Durable authorization state for replay-resistant LLM agent actions. arXiv preprint arXiv:2608.01710.
    [CrossRef] [Google Scholar]
  19. Zhang, W., Liu, Y., Yang, Z., Zhang, Z., Feng, H., Wang, X., ... & Hong, J. B. (2026). CARE: Pre-Execution Command Verification for Shell-Executing LLM Agents. arXiv preprint arXiv:2607.21642.
    [CrossRef] [Google Scholar]
  20. Zhang, Y. (2026). Agent libOS: A Runtime Substrate for Capability-Controlled Self-Evolving LLM Agents. arXiv preprint arXiv:2606.03895.
    [CrossRef] [Google Scholar]
  21. Wang, C., & Zheng, Y. (2026). Sandlock: Confining AI Agent Code with Unprivileged Linux Primitives. arXiv preprint arXiv:2605.26298.
    [CrossRef] [Google Scholar]
  22. Lan, Q., Kaul, A., Jones, S., & Westrum, S. (2026). Zero-trust runtime verification for agentic payment protocols: Mitigating replay and context-binding failures in AP2. arXiv preprint arXiv:2602.06345.
    [CrossRef] [Google Scholar]
  23. Stefanescu, S., & Aciobanitei, I. (2026). Lineage: A UMA2.0 Protocol Extension for Multi-Hop LLM Agent Delegation. IEEE Access, 14, 104574-104591.
    [CrossRef] [Google Scholar]
  24. He, J., & Yu, D. (2026). Verifiable Agentic Infrastructure: Proof-Derived Authorization for Sovereign AI Systems. arXiv preprint arXiv:2605.15228.
    [CrossRef] [Google Scholar]
  25. Rhodes, J., & Kang, G. (2026). Proof of Execution: Runtime Verification for Governed AI Agent Actions. arXiv preprint arXiv:2607.05397.
    [CrossRef] [Google Scholar]
  26. Dobrin, S., & Chmiel, Ł. (2026). The Unfireable Safety Kernel: Execution-Time AI Alignment for AI Agents and Other Escapable AI Systems. arXiv preprint arXiv:2606.26057.
    [CrossRef] [Google Scholar]
  27. Singh, G., & Madisetti, V. K. (2026). MCP-Secure: A Runtime Access Control Layer for Privilege-Aware LLM Agent Tooling. IEEE Open Journal of the Computer Society, 7, 504-513.
    [CrossRef] [Google Scholar]
  28. Jiang, J. (2026). Runtime Protection Practice for LLM Agent Security: An On-Demand Behavioral Sandbox Approach. In 2026 11th International Symposium on Advances in Electrical, Electronics and Computer Engineering (ISAEECE) (pp. 587-590).
    [CrossRef] [Google Scholar]
  29. Sharma, R. K., Jiang, L., Lin, Z., & Chen, S. (2026). PAuth - Precise Task-Scoped Authorization For Agents. arXiv preprint arXiv:2603.17170.
    [CrossRef] [Google Scholar]
  30. Bhushan, B., Pappu, K., Jadav, V., & Jaiswal, N. (2026, February). Risk-adaptive authorization for agentic ai systems. In SoutheastCon 2026 (pp. 1-6). IEEE.
    [CrossRef] [Google Scholar]
  31. Wu, M. (2026). SessionBound: Turning Enterprise Task Approval into Budgeted Database Sessions. arXiv preprint arXiv:2607.00751.
    [CrossRef] [Google Scholar]
  32. Zhu, G., & Wang, C. (2026). Intent-Governed Tool Authorization for AI Agents. arXiv preprint arXiv:2606.22916.
    [CrossRef] [Google Scholar]
  33. Santos-Grueiro, I. (2026). Context-to-Execution Integrity for LLM Agents. arXiv preprint arXiv:2607.06000.
    [CrossRef] [Google Scholar]
  34. Zhu, G., & Wang, C. (2026). Explanation-Bound Tool Execution for AI Agents: Server-Verified Action Claims Without Trusting Model Rationales. arXiv preprint arXiv:2607.25364.
    [CrossRef] [Google Scholar]
  35. Stanley, R., Verma, A., Tsai, L., Kallas, K., & Kumar, S. (2026). An AI Agent Execution Environment to Safeguard User Data. arXiv preprint arXiv:2604.19657.
    [CrossRef] [Google Scholar]
  36. Abaev, N., Klimov, D., Levinov, G., Mimran, D., Elovici, Y., & Shabtai, A. (2026). AgentGuardian: Learning Access Control Policies to Govern AI Agent Behavior. arXiv preprint arXiv:2601.10440.
    [CrossRef] [Google Scholar]
  37. Lin, J., Zhou, Z., Zheng, Z., Liu, S., Xu, T., Chen, Y., & Chen, E. (2026). VIGIL: Defending LLM Agents Against Tool-Stream Injection via Verify-Before-Commit. In Proceedings of the 64th Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers) (pp. 9764-9785). Association for Computational Linguistics.
    [CrossRef] [Google Scholar]
  38. Kahani, N., Barati, M., & Addae, D. (2026, October). Runtime Compliance Verification for AI Agents. In International Conference on Runtime Verification (pp. 254-271). Cham: Springer Nature Switzerland.
    [CrossRef] [Google Scholar]
  39. Rajagopalan, M., & Rao, V. (2026). Authenticated Workflows: A Systems Approach to Protecting Agentic AI. arXiv preprint arXiv:2602.10465.
    [CrossRef] [Google Scholar]
  40. Yuan, A., Su, Z., & Zhao, Y. (2026). AEGIS: No Tool Call Left Unchecked - A Pre-Execution Firewall and Audit Layer for AI Agents. arXiv preprint arXiv:2603.12621.
    [CrossRef] [Google Scholar]
  41. Sharma, R. M. (2026). Ethical Hyper-Velocity (EHV): A Hardware-Rooted Zero-Trust Runtime Enforcement Architecture for Agentic AI Systems. arXiv preprint arXiv:2605.17909.
    [CrossRef] [Google Scholar]
  42. Zheng, Y., Fan, J., Fu, Q., Yang, Y., Zhang, W., & Quinn, A. (2026). AgentCgroup: Understanding and Controlling OS Resources of AI Agents. arXiv preprint arXiv:2602.09345.
    [CrossRef] [Google Scholar]
  43. Wang, S., Zhu, S., & Li, R. (2026). Runtime Policy Enforcement for MCP-Based LLM Agents. Electronics, 15(13), 2829.
    [CrossRef] [Google Scholar]
  44. Zhu, J., Tseng, K., Vernik, G., Huang, X., Patil, S. G., Fang, V., & Popa, R. A. (2025). MiniScope: A Least Privilege Framework for Authorizing Tool Calling Agents. arXiv preprint arXiv:2512.11147. https://arxiv.org/abs/2512.11147v1
    [Google Scholar]
  45. Zheng, Y., Wu, T., Fu, Q., Yu, T., Mao, W., Ma, T., ... & Quinn, A. (2026). ActPlane: Programmable OS-Level Policy Enforcement for Agent Harnesses. arXiv preprint arXiv:2606.25189.
    [CrossRef] [Google Scholar]
  46. Mellafe Zuvic, D. (2026). Capability Gates Are Not Authorization: Confused-Deputy Failures in LLM Agent Frameworks. arXiv preprint arXiv:2606.28679.
    [CrossRef] [Google Scholar]
  47. Shi, T., He, J., Wang, Z., Li, H., Wu, L., Guo, W., & Song, D. (2025). Progent: Programmable Privilege Control for LLM Agents. arXiv preprint arXiv:2504.11703.
    [CrossRef] [Google Scholar]
  48. Kodathala, S. V. (2026). aiAuthZ: Off-Host, Identity-Bound Authorization for AI Agents. arXiv preprint arXiv:2607.05518.
    [CrossRef] [Google Scholar]
  49. Li, Y., Chen, Y., Wen, H., Zhang, B., Liu, H., Wang, P., ... & Tian, Y. (2026). VIGIL: Runtime Enforcement of Behavioral Specifications in AI Agent Skills. arXiv preprint arXiv:2606.26524.
    [CrossRef] [Google Scholar]
  50. Pan, S., Sun, X., Zhang, T., Liao, D., Si, M., & Xing, Z. (2026). SkillGuard: A Permission-Centric Framework for Agent Skill Security. arXiv preprint arXiv:2606.03024.
    [CrossRef] [Google Scholar]
  51. Mazzocchetti, A. (2026). Runtime Governance for Agentic AI: Action-Boundary Control with Trusted Provenance and Fail-Closed Execution. arXiv preprint arXiv:2608.16891.
    [CrossRef] [Google Scholar]
  52. Joshi, A., Finin, T., Joshi, K. P., & Kagal, L. (2026). Deontic Policies for Runtime Governance of Agentic AI Systems. In 2026 IEEE International Conference on Web Services (ICWS).
    [CrossRef] [Google Scholar]
  53. Sidik, B., & Rokach, L. (2026). Beyond Static Sandboxing: Learned Capability Governance for Autonomous AI Agents. arXiv preprint arXiv:2604.11839.
    [CrossRef] [Google Scholar]
  54. Wang, P., Li, Y., & Tian, Y. (2026). Aligning Provenance with Authorization: A Dual-Graph Defense for LLM Agents. arXiv preprint arXiv:2605.26497.
    [CrossRef] [Google Scholar]
  55. El Helou, M., Ryder, B., Troiani, C., Diaconu, J., Muyal, H., & Yannuzzi, M. (2026). Hybrid Inspection and Task-Based Access Control in Zero-Trust Agentic AI. arXiv preprint arXiv:2605.02682.
    [CrossRef] [Google Scholar]
  56. Weng, J., Weng, J., Chen, M., Li, M., Liu, J.-N., Li, Z., & Zhang, Y. (2026). From Neural Intent to Cryptographic Authorization: Securing AI-Driven Enterprise Workflows. arXiv preprint arXiv:2607.15596.
    [CrossRef] [Google Scholar]
  57. Yang, C. (2026). AgentTrust: Runtime Safety Evaluation and Interception for AI Agent Tool Use. arXiv preprint arXiv:2605.04785.
    [CrossRef] [Google Scholar]
  58. Bollig, B. (2026). Causal Past Logic for Runtime Verification of Distributed LLM Agent Workflows. arXiv preprint arXiv:2605.20923.
    [CrossRef] [Google Scholar]
  59. Gill-Lakhowal, A. (2026). Deterministic Runtime Enforcement: The Execution Authority for Autonomous AI Agents. IEEE Access, 14, 119764-119790.
    [CrossRef] [Google Scholar]
  60. Malik, A., Jayasinghe, D., Klemick, B., Shah, P., Talasu, N., & Trivedi, V. T. (2026). Decentralized Granular Access Control for Agentic AI Systems in Critical Infrastructure. arXiv preprint arXiv:2607.22611.
    [CrossRef] [Google Scholar]
  61. Gandikota, L. R., Jegathesan, V., & Reddy, C. D. R. (2026, May). Agentic AI in Cybersecurity: Threat Modeling and Containment Strategies for Autonomous LLM Agents. In 2026 2nd International Conference on Artificial Intelligence Systems (AIS) (pp. 68-75). IEEE.
    [CrossRef] [Google Scholar]
  62. Nirban, H. S., Hinduja, B., Mangal, B., Chakka, V., Sharma, Y., Srivastava, S. R., ... & Bhatia, A. (2026, April). A Zero-Trust Identity Framework for Autonomous AI Agents: Cryptographic Attestation and Policy-Driven Authorization. In International Conference on Advanced Information Networking and Applications (pp. 258-269). Cham: Springer Nature Switzerland.
    [CrossRef] [Google Scholar]
  63. Li, F. (2026). OpenClaw PRISM: A Zero-Fork, Defense-in-Depth Runtime Security Layer for Tool-Augmented LLM Agents. arXiv preprint arXiv:2603.11853.
    [CrossRef] [Google Scholar]
  64. Shi, T., Mo, Y., Liu, Y., Hao, Z., Wang, Y., Hu, W., ... & Yu, J. (2026). Organizational Control Layer: Governance Infrastructure at the Execution Boundary of LLM Agent Systems. arXiv preprint arXiv:2606.04306.
    [CrossRef] [Google Scholar]
  65. Cai, Y., Wang, Z., Deng, Z., Yao, M., Liu, J., Hu, Y., ... & Li, D. (2025). Who Grants the Agent Power? Defending Against Instruction Injection via Task-Centric Access Control. In Proceedings of the 2025 Workshop on Security and Privacy of AI-Empowered Mobile Super Apps (SaTS).
    [CrossRef] [Google Scholar]
  66. Xiong, Y., Hao, L., He, S., Wang, Y., & Li, L. (2026). JANUS: Foreseeing Latent Risk for Long-Horizon Agent Safety. arXiv preprint arXiv:2607.19913.
    [CrossRef] [Google Scholar]
  67. Ntousakis, G., Stephen, J. J., Le, M. V., Chukkapalli, S. S. L., Taylor, T., Molloy, I. M., & Araujo, F. (2025, October). Securing mcp-based agent workflows. In Proceedings of the 4th Workshop on Practical Adoption Challenges of ML for Systems (pp. 50-55).
    [CrossRef] [Google Scholar]
  68. Betser, R., Bose, S., Giloni, A., Picardi, C., Padakandla, S., & Vainshtein, R. (2026). AgenTRIM: Tool Risk Mitigation for Agentic AI. arXiv preprint arXiv:2601.12449.
    [CrossRef] [Google Scholar]
  69. Zhou, Z. (2026). Governing Dynamic Capabilities: Cryptographic Binding and Reproducibility Verification for AI Agent Tool Use. arXiv preprint arXiv:2603.14332.
    [CrossRef] [Google Scholar]
  70. Xiang, R. (2026). Structural Enforcement of Goal Integrity in AI Agents via Separation-of-Powers Architecture. arXiv preprint arXiv:2604.23646.
    [CrossRef] [Google Scholar]

Cite This Article

APA Style
Wu, J. M. T., Kong, L., Pirouz, M., & Wu, M. E. (2026). Beyond Guardrails: Runtime Enforcement for Secure AI Agents-A Systematic Review of Action Control, Isolation, and Policy Enforcement. Journal of Reliable and Secure Computing, 2(4), 236-262. https://doi.org/10.62762/JRSC.2026.526903
Export Citation
RIS Format
Compatible with EndNote, Zotero, Mendeley, and other reference managers
TY  - JOUR
AU  - Wu, Jimmy Ming-Tai
AU  - Kong, Lingping
AU  - Pirouz, Matin
AU  - Wu, Mu-En
PY  - 2026
DA  - 2026/10/17
TI  - Beyond Guardrails: Runtime Enforcement for Secure AI Agents-A Systematic Review of Action Control, Isolation, and Policy Enforcement
JO  - Journal of Reliable and Secure Computing
T2  - Journal of Reliable and Secure Computing
JF  - Journal of Reliable and Secure Computing
VL  - 2
IS  - 4
SP  - 236
EP  - 262
DO  - 10.62762/JRSC.2026.526903
UR  - https://www.icck.org/article/abs/JRSC.2026.526903
KW  - AI agents
KW  - runtime enforcement
KW  - agent security
KW  - execution-time authorization
KW  - access control
KW  - runtime verification
AB  - Large language model (LLM) agents turn model-generated decisions into tool calls, API requests, code execution, data access, and transactions. When agent reasoning is manipulated or simply wrong, model-centric guardrails cannot by themselves stop the resulting action. We systematically reviewed runtime-enforcement mechanisms for autonomous and tool-using AI agents in literature published or publicly available from January 2023 to September 2026. Searches of Compendex and the Web of Science Core Collection, followed by deduplication, multi-stage screening, source-grounded eligibility assessment, and targeted snowballing, yielded 58 primary studies, which we coded by enforcement placement, security mechanism, and assurance type. Most studies enforce security at the tool/action boundary (33/58, 56.9%) or inside the agent runtime or harness (18/58, 31.0%), whereas only 7/58 (12.1%) work primarily at the OS/process/execution boundary. Authorization and privilege control (41/58, 70.7%) and action validation (34/58, 58.6%) are the most common mechanism families. Across very different mechanisms and assurance models, a common design emerges: the model proposes an action, and a separate enforcement point decides whether that action may take external effect. Durable authorization, multi-agent delegation, cross-layer enforcement, recovery from partially committed effects, and standardized evaluation remain open problems. These findings suggest that secure agent architectures should separate reasoning from execution authority and place consequential actions behind independently enforceable runtime boundaries.
SN  - 3070-6424
PB  - Institute of Central Computation and Knowledge
LA  - English
ER  -
BibTeX Format
Compatible with LaTeX, BibTeX, and other reference managers
@article{Wu2026Beyond,
  author = {Jimmy Ming-Tai Wu and Lingping Kong and Matin Pirouz and Mu-En Wu},
  title = {Beyond Guardrails: Runtime Enforcement for Secure AI Agents-A Systematic Review of Action Control, Isolation, and Policy Enforcement},
  journal = {Journal of Reliable and Secure Computing},
  year = {2026},
  volume = {2},
  number = {4},
  pages = {236-262},
  doi = {10.62762/JRSC.2026.526903},
  url = {https://www.icck.org/article/abs/JRSC.2026.526903},
  abstract = {Large language model (LLM) agents turn model-generated decisions into tool calls, API requests, code execution, data access, and transactions. When agent reasoning is manipulated or simply wrong, model-centric guardrails cannot by themselves stop the resulting action. We systematically reviewed runtime-enforcement mechanisms for autonomous and tool-using AI agents in literature published or publicly available from January 2023 to September 2026. Searches of Compendex and the Web of Science Core Collection, followed by deduplication, multi-stage screening, source-grounded eligibility assessment, and targeted snowballing, yielded 58 primary studies, which we coded by enforcement placement, security mechanism, and assurance type. Most studies enforce security at the tool/action boundary (33/58, 56.9\%) or inside the agent runtime or harness (18/58, 31.0\%), whereas only 7/58 (12.1\%) work primarily at the OS/process/execution boundary. Authorization and privilege control (41/58, 70.7\%) and action validation (34/58, 58.6\%) are the most common mechanism families. Across very different mechanisms and assurance models, a common design emerges: the model proposes an action, and a separate enforcement point decides whether that action may take external effect. Durable authorization, multi-agent delegation, cross-layer enforcement, recovery from partially committed effects, and standardized evaluation remain open problems. These findings suggest that secure agent architectures should separate reasoning from execution authority and place consequential actions behind independently enforceable runtime boundaries.},
  keywords = {AI agents, runtime enforcement, agent security, execution-time authorization, access control, runtime verification},
  issn = {3070-6424},
  publisher = {Institute of Central Computation and Knowledge}
}

Article Metrics

Citations
Crossref
0
Scopus
0
Views
7
PDF Downloads
1

Publisher's Note

ICCK stays neutral with regard to jurisdictional claims in published maps and institutional affiliations.

Rights and Permissions

CC BY Copyright © 2026 by the Author(s). Published by Institute of Central Computation and Knowledge. This article is an open access article distributed under the terms and conditions of the Creative Commons Attribution (CC BY) license (https://creativecommons.org/licenses/by/4.0/), which permits use, sharing, adaptation, distribution and reproduction in any medium or format, as long as you give appropriate credit to the original author(s) and the source, provide a link to the Creative Commons licence, and indicate if changes were made.
Journal of Reliable and Secure Computing
Journal of Reliable and Secure Computing
ISSN: 3070-6424 (Online)
Portico
Preserved at
Portico

Article QR Code

Article QR Code
Scan to read this article
Submit Manuscript Edit a Special Issue

Popular Articles

Share This Article